TWP Advanced failure protection by fieldbus device...

TECHNICAL WHITE PAPER ADVANCED FAILURE PROTECTION BY FIELDBUS DEVICE COUPLERS

This paper will cover the features and operational benefits of the latest generation of fieldbus device couplers, describing the methodology used to reliably prevent segment failures caused by "real-life" operational faults that have previously been impossible to protect against.

Finally, this paper will briefly describe the complementary equip-ment for the latest generation of device couplers which provide the highest level of fieldbus availability.

Prepared by: Gunther Rogoll and Ren Kitchener

Quality Information from a Quality Supplier This technical white paper utilizes Pepperl+Fuchs’ expertise and knowledge to provide a clear insight into the many new technology and application issues you may face with a fieldbus installation. It corresponds with our way of work-ing and thinking: combining state-of-the-art technologies with years of research and innovation to simplify planning, installation and commissioning, operation, and plant upkeep.

If the content of this paper sparks comments or questions, we invite you to contact your Pepperl+Fuchs office or repre-sentative to get in touch with the experts. We are glad to share our expertise with you for your business success.

Our promise is to simplify your work processes: You can stay focused on your day-to-day business with a reliable FieldConnex® fieldbus infrastructure. It ensures the connection between DCS and instruments—fully digital with ex-plosion protection for any hazardous area. We are driven to provide innovation with proven reliability for process au-tomation practitioners:

FieldConnex is robust, reliable, and the first choice of many well-known end users worldwide.

Advanced physical layer diagnostics reach down to spurs, accessories, and instruments; interpret data, and provide detailed fault analysis. Water ingress and worn-out surge protectors are identified without manual checking.

The High-Power Trunk concept allows long cable runs and high device counts and is now an industry stand-ard. DART Fieldbus makes the High-Power Trunk intrinsically safe.

We hope that the contents of this paper are helpful to your daily work or decision process. We look forward to hearing from you.

Advanced Failure Protection by Fieldbus Device Couplers Introduction

www.pepperl-fuchs.com 1/9

2012

-11-

29 E

DM

TD

OCT

-286

0_EN

G

Table of Contents

1 Introduction .................................................................................................................... 2

2 Classic spur short-circuit protection .................................................................................. 2

2.1 Function ............................................................................................................................. 2

2.2 Practical limits of classic short-circuit protection .................................................................. 2

3 The real-life faults ............................................................................................................ 3

3.1 Direct low Ohm short circuits ............................................................................................... 3

3.2 Water ingress ..................................................................................................................... 4

3.3 Attaching and disconnecting a device .................................................................................. 4

3.4 Vibration/Machine-induced intermittent faults ...................................................................... 5

4 The latest generation of device couplers ............................................................................ 5

4.1 Progressive fault protection .................................................................................................. 5

4.2 Contact bounce fault protection ............................................................................................ 5

4.3 Enclosure leakage detection ................................................................................................ 6

4.4 Integrated Physical Layer Diagnostics .................................................................................. 6

4.5 Surge protection diagnostics ................................................................................................ 7

5 Summary ......................................................................................................................... 9

6 References ...................................................................................................................... 9

Introduction Advanced Failure Protection by Fieldbus Device Couplers

2/9 www.pepperl-fuchs.com

2012

-11-

29 E

DM

TD

OCT

-286

0_EN

G

1 Introduction Fieldbus device couplers, such as Segment Pro-tectors and FieldBarriers, are used extensively in most modern day plant installations. The current generation of active fieldbus device couplers plays many important roles, from serving as a convenient device connection point to providing protection against device and spur cable faults. In addition, intrinsically safe outputs for High-Power Trunk fieldbus require a device coupler, not only for the galvanic isolation electronics, but also for intrinsically safe power limiting.

Historically, rudimentary fast-acting (electronic) spur short-circuit protection and isolation was introduced into passive device couplers to pro-tect the segment from spur short circuits. This is because fieldbus is a multi-drop bus system, with devices that are attached directly to a com-mon trunk, via spurs. Since there are more spurs than there are trunks, work is more frequently performed at the spur level, rather than on the trunk. Furthermore, the spur is less protected from potential faults. For example, trunks are usually secured in cable trays or cable ladders, out of reach and less exposed. The spur cable is more accessible and the cable is often coiled at the device. Maintenance occurs more at the spur level when servicing or repairing field devices.

This does not imply that fieldbus is an unreliable control platform—far from it. A well maintained, fully protected, and fully monitored system is extremely reliable. But there are uncontrollable influences that lead to failure if not addressed or if they are "conveniently" ignored.

Incremental protection and monitoring concepts have been gradually implemented over the years, with the introduction of Advanced Physi-cal Layer Diagnostics and rudimentary spur short-circuit protection. Pepperl+Fuchs has gathered a substantial amount of fault/failure data over the last six years. Analyzing this data has led to new solutions and new approaches to previously unpreventable faults. These advances will significantly increase the integrity of fieldbus segments.

In this paper, we will be covering the various fault scenarios and methods that will safely iso-late a fault when required, but also allow the segment to continue working if it is safe to do so, during an infrequent or tolerable interruption.

2 Classic spur short-circuit pro-tection

2.1 Function The current range of spur fault protection device couplers available on the market are designed and tested in accordance with FOUNDATION™ fieldbus test specification FF-846. The tests in-clude "single shot," zero resistance, and zero bounce tests which are tests under laboratory conditions, rather than a practical real-life fault.

The typical current-limiting electronics, to meet the FOUNDATION™ fieldbus tick-marks, have a basic operation. This current limiting performs the task of protection only under very precise and controlled low resistance and continuous short circuits, extending to gradual resistive fault tests which, in the real world, are not seen very often.

Until now, short-circuit protection electronics has been capable only of dealing with direct and steady short circuits:

In other words, intermittent faults, caused by contact bounce or repetitive short- or open-circuit faults created by bad connections or loose connections, will affect the segment—even with classic short-circuit protection implemented.

2.2 Practical limits of classic short-circuit protection

A loose connection on a device, under vibration, will connect and disconnect the spur to the de-vice at the vibration frequency—even under very low vibration levels. This means that a 20 mA device will cause a signal level of 1 V p-p, which is equal to the fieldbus signal level, to be present on the trunk.

Because the current change or interruption does not reach the short-circuit current, the spur pro-tection electronics will not see the device current as a fault. If the vibration frequency is 15 Hz, then 30 make-break operations will occur every se-cond, causing enough data destruction for the segment to fail. In addition, connection and dis-connection operations of a device can cause contact bounce and multiple make-break opera-tions.

Advanced Failure Protection by Fieldbus Device Couplers The real-life faults


2012

-11-

29 E

DM

TD

OCT

-286

0_EN

G

Figure 2-1 : Telegram disturbances due to vibration

Even following the right protocol, and connecting a device at the Segment Protector level, can cause contact bounce or misalignment repeat make-break contacts if the connection is indeci-sive. A connector or wire may also not be fully engaged before the clamping screws are tight-ened, this leading to the possibility of multiple make-break connections.

3 The real-life faults As briefly mentioned earlier, spur faults are rare-ly clear cut and with experience, we find that many short-circuit faults are unpredictable.

Spur faults discovered over the years have been known to cause the failure of a working segment even when fitted with typical spur short-circuit protection. Tests to replicate the failures in real applications have shown that the potential is real and fairly repeatable.

Figure 3-1: Contact bouncing due to plugging and pulling of spur connector terminal blocks

3.1 Direct low Ohm short circuits Direct low Ohm short-circuit faults are commonly seen where a spur cable is cut, or where a ground fault exists on one pole and the other pole is shorted to ground. They are also com-monly seen where spur wires are drawn through electrical housings while removing the device for repair or calibration (although this often leads to a very noisy intermittent fault).

Figure 3-2: Example of the spur poles shorting through the terminal housing while the wires are being withdrawn

With a single clean ‘make’ the spur protection system will react very quickly to isolate the spur where only one telegram will be affected:

Loose contact

"Make" disturbance

"Break"

disturbance

Fieldbus power

Classic Segment Protector

Device

Vibr

atio

n fr

eque

ncy

Trun

k si

gnal

Trun

k

Spur

Vibration

Failed telegram

The real-life faults Advanced Failure Protection by Fieldbus Device Couplers


2012

-11-

29 E

DM

TD

OCT

-286

0_EN

G

Figure 3-3: Fault measurement on the trunk due to a clean short circuit. The short-circuit protection circuit isolates the spur by switching off the cur-rent.

3.2 Water ingress Instrument housing water ingress is a failure that has been reported on more than one occasion. Replicating this in the laboratory revealed that the conventional short-circuit protection systems behave unpredictably at certain conductivity levels due to the dynamic impedance of water, which can rapidly change in conductivity.

With increasing conductivity between the fieldbus wires, the current-limiting electronics start to dampen the communication signals due to increasing impedance.

Figure 3-4: Oscilloscope trace showing a heavily distorted communication signal due to current draw near the short current limit, caused by water conductivity

Oscillation sometimes occurs when a fault cur-rent is at or marginally above the current limit set point, and the electronic circuit is just barely operating. At this point, the voltage to the fault decreases with a resulting decrease in current, turning off the current-limiting circuit. This cycle continues quite rapidly and can be amplified when a device is transmitting at the same time. The reaction during this narrow transition point can be unpredictable. Not every fault behaves in a repeatable way. For example, water’s imped-ance can be very nonlinear versus voltage or

current, where this further varies with tempera-ture and conductivity.

Also, water ingress can lead to mechanical fail-ures such as irreversible corrosion damage to electronics, terminals, or cable parts.

Figure 3-5: Corrosion of terminal arrangement in a transmitter housing due to water penetration

One example shows the seriousness of the fault scenario: A field instrument with an active back-up LAS loses communication to a host installed in the control room, due to the low communica-tion signal during a progressive fault occurrence. The backup LAS activates while the host LAS remains active. At this point, field instruments on normally operating spurs still "see" the back-up LAS, which is nearby, as well as the host. With two active LASs on the segment, communi-cation clashes and the segment fails.

3.3 Attaching and disconnecting a device

The use of device connectors may seem like a safe way to connect a device without the possi-bility of shorting the wires. By inserting the con-nector, a slow connection or adjustment can systematically connect and disconnect the de-vice over a one-second period or longer. This connection chatter or contact bounce severely disrupts communication, even with electronic short-circuit protection, due to the current being below the trip threshold to the point of segment failure.

This type of fault is also seen with loose connec-tions, drawing cable through electrical housings with loose strands of copper making contact with other connections, connectors, and device elec-tronic failure or faults.

Advanced Failure Protection by Fieldbus Device Couplers The latest generation of device couplers


2012

-11-

29 E

DM

TD

OCT

-286

0_EN

G

Figure 3-6: Voltage spikes caused by spur poles shorting through the terminal housing while the wires are being withdrawn

3.4 Vibration/Machine-induced in-termittent faults

In some cases, high-frequency mechanical vibra-tion can cause a loose or poor contact to make and break or even loosen a terminal. This re-peated interruption will cause the segment to fail if it is not isolated immediately.

Figure 3-7: Vibration induced voltage spikes

In one case, the device was the cause of a vibra-tion-induced fault, where the printed circuit board connection to the terminal contained a "dry joint" which was not easy to see without taking the instrument apart.

Industrial equipment for process industries is mostly designed to be installed in environments where vibration with a frequency of up to 150 Hz could occur.

4 The latest generation of device couplers

The latest Pepperl+Fuchs device coupler design is focused on fault tolerance against many of the typical failure conditions at the spur/field device level. These conditions include those which cause segment failure even with the classic range of spur fault protection device couplers.

Under these real-life failure conditions, the fieldbus trunk and all other field devices remain

in operation. When the fault is repaired, or the fault has cleared, the Segment Protector auto-matically resumes normal operation and recon-nects the spur and device.

Integrated Physical Layer Diagnostics monitors the physical layer and detects propagating fail-ures which develop over time.

Device couplers provide an interface to auxiliary equipment such as water leakage sensors or surge protectors to transmit their health state.

The operator or maintenance engineer is notified by an alarm before failures can become critical and affect the availability of the fieldbus seg-ment.

Figure 4-1: Latest Segment Protector with surge protectors at trunk and spurs

4.1 Progressive fault protection Progressive spur short-circuit protection pre-vents fieldbus segment failure in situations where the spur current progressively increases, as mentioned before, due to water in the termi-nal housing or device electronics degradation. The new device coupler´s “progressive spur short-circuit protection” detects small increases in spur currents, which indicate an evolving fault. The faulty spur is isolated from the fieldbus segment before tripping the spur protection electronics or creating low destructive imped-ance.

4.2 Contact bounce fault protection Periodic or intermittent changes in the current within a fieldbus segment cause continuous communication failures resulting in segment failure. Changes in the spur current can occur during connection and disconnection of the spur wires, or due to fractured or loose wires when there is vibration. Pepperl+Fuchs "spur contact bounce protection" isolates a faulty spur from

The latest generation of device couplers Advanced Failure Protection by Fieldbus Device Couplers


2012

-11-

29 E

DM

TD

OCT

-286

0_EN

G

the segment to prevent segment failures caused by intermittent faults.

Figure 4-2: Spur shutoff due to contact bouncing

4.3 Enclosure leakage detection Although fault-tolerant electronics can isolate a fault caused by water ingress as described in section 4.2, the damage that can be done by the time you reach that stage is a problem within itself. If the fault remains for some time, corro-sion damage can already be underway before the enclosure is emptied of water and repaired.

In this case, Pepperl+Fuchs has developed an early warning system in the form of an enclosure leakage sensor (ELS-1). The ELS-1 contains a unique diagnostic function to quickly detect water ingress breaches inside transmitter hous-ings or junction boxes, before they can adversely affect fieldbus communication, demand high current levels, or even lead to irreversible gal-vanic corrosion damage to electronics, termi-nals, or cable parts. Its compact design allows the ELS-1 to fit into most of today’s existing field device housings. The ELS-1 is connected in paral-lel to the spur output cables of the Pep-perl+Fuchs device coupler or device and is pow-ered from the spur.

Once water is detected, the diagnostic electron-ics generate an alarm, which the Pepperl+Fuchs advanced diagnostics infrastructure receives. This alarm is transmitted to the system’s maintenance or operator station containing Pep-perl+Fuchs "Advanced Diagnostic Manager" software or directly into the DCS alarm system. The Diagnostic Manager shows sensor alarms as a “coupler alarm” by tagging field devices con-nected to the same spur as the ELS-1, allowing the maintenance engineer to easily identify the affected enclosure. Additionally, the ELS-1 pro-vides a visual alarm so that the affected de-vice/enclosure can be quickly identified or the fault validated.

Figure 4-3: Enclosure leakage sensor ELS-1

4.4 Integrated Physical Layer Diag-nostics

There are many examples of fault tolerance, i.e., the segment can tolerate the fault and continue working, and many examples of where the fault needs to be isolated immediately, such as a direct short circuit. But some faults evolve over time before they become disruptive. In these cases, the emphasis is on fault detection. This is where the Advanced Physical Layer Diagnostics systems can play a more proactive role by moni-toring any physical layer deviations that may be a precursor to a spur or trunk fault. Much of this information is covered in two earlier papers ti-tled:

Pepperl+Fuchs white paper: "Fieldbus Testing with Online Physical Layer Diagnostics," 2007, Part. Nr. 198636

and

Pepperl+Fuchs white paper: "Advanced Online Physical Layer Diagnostics," 2008, Part. Nr. 198641

Evolving faults that can be detected by the Ad-vanced Diagnostic System may contain a primary fault that in itself may not affect the segment. For example, a pole-to-ground fault will not fail an isolated and balanced segment. However, a secondary fault on the opposite pole to ground that may be at the opposite end of the spur cable will cause a spur to go into current limiting, with the loss of a control device. Alternatively, this can lead to a very disruptive intermittent fault with no obvious cause. In this case, the Ad-vanced Diagnostic Module will have detected the primary ground fault immediately so that the potential of a serious fault evolving will be elimi-nated.

Advanced Failure Protection by Fieldbus Device Couplers The latest generation of device couplers


2012

-11-

29 E

DM

TD

OCT

-286

0_EN

G

4.5 Surge protection diagnostics Outside or external influences can lead to seg-ment failures, including overvoltage spikes caused by static discharges or secondary light-ning strikes. High voltages can cause common segment components to fail or degrade.

For Pepperl+Fuchs new range of device couplers, optional plug-in surge protection modules for the trunk and spur cables are available and used for safeguarding the Segment Protector electronics against excessive surges and over-voltages.

The surge protectors contain a unique diagnostic function that can predict surge protector failures before they adversely affect fieldbus communica-tion or segment voltages.

The surge protector diagnostics monitors, measures, and records any overvoltage event, then compares the events to a given algorithm to predict how many more overvoltage events can be tolerated before the surge protection elec-

tronics fail or degrade to the point of affecting fieldbus communication. Surge protection elec-tronics can tolerate a given number or frequency of activations at given levels of voltage before they completely fail due to the degradation of the surge protection electronics. The diagnostic electronics log and compare any activation to an algorithm that decides if the surge protection electronics is reaching its "end of effective life." At this point, the diagnostic electronics gener-ates an alarm that the Pepperl+Fuchs advanced diagnostics infrastructure will receive. From there, this alarm is transmitted to the system’s maintenance or operator terminal containing Pepperl+Fuchs Advanced Diagnostic Manager software.

More information about the new surge protectors is available in the white paper “ADVANCED DIAG-NOSTIC Fieldbus Surge Protection” [5] from Pep-perl+Fuchs.

Figure 4-4: FieldConnex advanced physical layer infrastructure including surge protectors with integrated diag-nostics.

The latest generation of device couplers Advanced Failure Protection by Fieldbus Device Couplers


2012

-11-

29 E

DM

TD

OCT

-286

0_EN

G

Table 1: Comparison of failure modes and their detection

PROTECTION against

Supported by

Classic device couplers

New generation device couplers

Static spur short circuits, with no or little contact bounce (resistive short circuits typically less than 200 Ohms).

YES YES

Progressive current faults; load current increases or decreases over time.

NO YES

Intermittent cable makes/breaks and contact bounce such as from loose terminals, fractured wires, bad connection procedures, or vibration with poor con-nections.

NO YES

Cable wire pulling through housing causing multiple short circuits to each other and/or to ground.

NO YES

Impedance faults caused by device faults. NO YES

DETECTION of

Water ingress making contact with the device termi-nals (see also ELS-1 early warning system).

NO YES

Surge protector maintenance/failure alarm NO YES

Degradation of the physical layer due to integrated Advanced Physical Layer Diagnostics at the spur level

NO YES

Advanced Failure Protection by Fieldbus Device Couplers Summary


2012

-11-

29 E

DM

TD

OCT

-286

0_EN

G

5 Summary From the faults reported over many years, and from analysing the typical faults that have caused segments to fail, it has become clear that not all faults seen at the spur level are simple, clean spur cable short-circuits. Intermittent at-tachment of a device is a good example of this. Traditional spur protection will not activate to protect the segment from this type of disruption. Many spur protection methods must be able to tolerate a degree of short-circuit current or over current levels in order to accommodate device inrush currents, without suddenly isolating the spur for a long period of time.

Also, faults at the threshold of the trip level, for example; water ingress, which can lead to un-predictable operation and severe signal distor-tion on the segment, must be quickly isolated to prevent oscillation or signal distortion. On the other hand, infrequent faults or disruptions, seen when a device is attached to a segment in normal operation, should not be automatically isolated unless they are at the point of possibly affecting the segment. This can lead to unneces-sary tripping where devices can be allowed to continue to operate if the interruption is not severe or the interruption is infrequent.

Consequently, the latest generation of fault-tolerant fieldbus Segment Protectors has been redesigned to intelligently assess faults in more detail, without compromising reliability or oper-ability. Therefore, the types of faults known to lead to segment failures are isolated. There are other influences that lead to segment failure over time which can combine with less critical faults, such as a grounded pole fault. Monitoring and catching early indications of potential faults with the Pepperl+Fuchs advanced physical layer di-agnostic modules, in combination with the intel-ligent fault tolerant device coupler, will lead to the highest level of integrity ever seen.

6 References [1] Device Coupler Test Specification FF-846,

Fieldbus Foundation™

[2] Fieldbus Engineering Guideline AG-181, Fieldbus Foundation

[3] Pepperl+Fuchs white paper: "Fieldbus Test-ing with Online Physical Layer Diagnostics," 2007, Part Nr.198636

[4] Pepperl+Fuchs white paper: "Advanced Online Physical Layer Diagnostics," 2008, Part Nr. 198641

[5] Pepperl+Fuchs white paper: "Advanced di-agnosed Fieldbus Surge Protection," 2012, Part Nr. 250721

S
ubject to reasonable modifications due to technical advances • Copyright PEPPERL+FUCHS • Printed in Germany • Part No: 250720 11/2012

TWP Advanced failure protection by fieldbus device...

Documents

Transcript of TWP Advanced failure protection by fieldbus device...